System and method for anomaly detection using images

ABSTRACT

The present invention relates to a method of detecting an anomaly using a plurality of images. The method comprises determining a subset of images from the plurality of images, comprising one or more first features. Further, one or more regions comprising one or more second features are identified in each image from the subset of images. Finally, detecting the anomaly from the subset of images based on the one or more regions. Therefore, accuracy of detecting anomalies is increased by using the subset of images.

TECHNICAL FIELD

The present disclosure relates to the field of computer vision and imageprocessing. Particularly, but not exclusively, the present disclosurerelates to a method for detecting anomaly using images.

BACKGROUND

Generally, detecting anomalies from a collection of images is performedin various domains. For example, anomaly detection is used to identifymanufacturing defects in articles such as shoes, apparel, containers,and the like. In another example, the anomaly detection is used toidentify cracks in constructions. In yet another example, the anomalydetection is used to identify the presence and type of disease frommedical images. Conventionally, anomaly detection was performed manuallyby human inspection. Detecting anomalies by human inspection is notaccurate, not cost-effective, and leads to an increased delay when acount of images is higher such as a few tens or hundreds of images.

Existing techniques use one or more image processing techniques such asimage segmentation and Artificial Intelligence (AI) based techniquessuch as neural networks for anomaly detection using images. However, theaccuracy of the anomaly detection using the existing techniques reduceswhen there is a wide range of variations such as missing anomalies inthe images, distorted images of anomalies, partial presence of anomaliesin the images and the like. The wide range of variations in the imagesleads to incorrect anomaly detection and/or anomaly detection with lowconfidence scores. Therefore, there is a need for an efficient techniquefor performing anomaly detection when the wide range of variations arepresent in the images.

The information disclosed in this background of the disclosure sectionis only for enhancement of understanding of the general background ofthe invention and should not be taken as an acknowledgement or any formof suggestion that this information forms the prior art already known toa person skilled in the art.

SUMMARY

Other embodiments and aspects of the disclosure are described in detailherein and are considered a part of the claimed disclosure.

Disclosed herein is a method for detecting an anomaly using a pluralityof images. The method comprising determining a subset of images from theplurality of images, comprising one or more first features. Further, themethod comprises identifying one or more regions comprising one or moresecond features in each image from the subset of images. Finally, themethod comprises detecting the anomaly from the subset of images basedon the one or more regions.

Embodiments of the present disclosure discloses an anomaly detectionsystem for detecting an anomaly using a plurality of images. The anomalydetection system comprises a processor and a memory communicativelycoupled to the processor. The memory stores the processor instructions,which, on execution, causes the processor to determine a subset ofimages from the plurality of images, comprising one or more firstfeatures. Further, the instructions cause the processor to identify oneor more regions comprising one or more second features in each imagefrom the subset of images. Finally, the instructions cause the processorto detect the anomaly from the subset of images based on the one or moreregions.

Embodiments of the present disclosure discloses a non-transitorycomputer readable medium including instructions stored thereon that whenprocessed by at least one processor cause a device to perform operationscomprising determining a subset of images from the plurality of images,comprising one or more first features. Further, identifying one or moreregions comprising one or more second features in each image from thesubset of images. Finally, detecting the anomaly from the subset ofimages based on the one or more regions.

The foregoing summary is illustrative only and is not intended to be inany way limiting. In addition to the illustrative aspects, embodiments,and features described above, further aspects, embodiments, and featuresmay become apparent by reference to the drawings and the followingdetailed description.

BRIEF DESCRIPTION OF THE ACCOMPANYING DRAWINGS

The novel features and characteristic of the disclosure are set forth inthe appended claims. The disclosure itself, however, as well as apreferred mode of use, further objectives and advantages thereof, maybest be understood by reference to the following detailed description ofan illustrative embodiment when read in conjunction with theaccompanying drawings. The accompanying drawings, which are incorporatedin and constitute a part of this disclosure, illustrate exemplaryembodiments and, together with the description, serve to explain thedisclosed principles. In the figures, the left-most digit(s) of areference number identifies the figure in which the reference numberfirst appears. One or more embodiments are now described, by way ofexample only, with reference to the accompanying figures wherein likereference numerals represent like elements and in which:

FIG. 1 shows an exemplary environment for detecting an anomaly using aplurality of images, in accordance with some embodiments of the presentdisclosure;

FIG. 2 shows a detailed block diagram of an anomaly detection system, inaccordance with some embodiments of the present disclosure;

FIG. 3 shows a flowchart illustrating method steps for detecting ananomaly using a plurality of images, in accordance with some embodimentof the present disclosure;

FIG. 4A shows an exemplary illustration of first set of training imagesand a corresponding label used to train a first model, in accordancewith some embodiments of the present disclosure;

FIG. 4B shows an exemplary illustration of training the first model, inaccordance with some embodiments of the present disclosure;

FIG. 4C shows an exemplary illustration of determining subset of imagesfrom the plurality of images using the first model, in accordance withsome embodiments of the present disclosure;

FIG. 4D shows an exemplary illustration of one or more clustersdetermined using a second model, in accordance with some embodiments ofthe present disclosure;

FIG. 4E shows an exemplary identifying one or more regions in the subsetof images using a second model, in accordance with some embodiments ofthe present disclosure;

FIG. 4F shows an exemplary illustration of second set of training imagesand a corresponding second label used to train a third model, inaccordance with some embodiments of the present disclosure;

FIG. 4G shows an exemplary training of the third model, in accordancewith some embodiments of the present disclosure;

FIG. 4H shows an exemplary illustration of detecting anomaly in thesubset of images using the third model, in accordance with someembodiments of the present disclosure;

FIG. 4I shows an exemplary table illustrating consolidated output of thethird model, in accordance with some embodiments of the presentdisclosure; and

FIG. 5 shows an exemplary computer system for detecting an anomaly usinga plurality of images, in accordance with some embodiments of thepresent disclosure.

It should be appreciated by those skilled in the art that any blockdiagrams herein represent conceptual views of illustrative systemsembodying the principles of the present subject matter. Similarly, itmay be appreciated that any flow charts, flow diagrams, state transitiondiagrams, pseudo code, and the like represent various processes whichmay be substantially represented in computer readable medium andexecuted by a computer or processor, whether or not such computer orprocessor is explicitly shown.

DETAILED DESCRIPTION

In the present document, the word “exemplary” is used herein to mean“serving as an example, instance, or illustration.” Any embodiment orimplementation of the present subject matter described herein as“exemplary” is not necessarily to be construed as preferred oradvantageous over other embodiments.

While the disclosure is susceptible to various modifications andalternative forms, specific embodiment thereof has been shown by way ofexample in the drawings and may be described in detail below. It shouldbe understood, however that it is not intended to limit the disclosureto the particular forms disclosed, but on the contrary, the disclosureis to cover all modifications, equivalents, and alternative fallingwithin the scope of the disclosure.

The terms “comprises”, “includes” “comprising”, “including” or any othervariations thereof, are intended to cover a non-exclusive inclusion,such that a setup, device or method that comprises a list of componentsor steps does not include only those components or steps but may includeother components or steps not expressly listed or inherent to such setupor device or method. In other words, one or more elements in a system orapparatus proceeded by “comprises . . . a” or “includes . . . a” doesnot, without more constraints, preclude the existence of other elementsor additional elements in the system or apparatus.

In the following detailed description of the embodiments of thedisclosure, reference is made to the accompanying drawings that form apart hereof, and in which are shown by way of illustration specificembodiments in which the disclosure may be practiced. These embodimentsare described in sufficient detail to enable those skilled in the art topractice the disclosure, and it is to be understood that otherembodiments may be utilized and that changes may be made withoutdeparting from the scope of the present disclosure. The followingdescription is, therefore, not to be taken in a limiting sense.

FIG. 1 shows an exemplary environment for detecting an anomaly using aplurality of images, in accordance with some embodiments of the presentdisclosure.

In an embodiment, an anomaly detection system (102) is used fordetecting an anomaly (104) using a plurality of images (101). Theanomaly detection system (102) may be implemented in a server, asmartphone, a computer, and the like. The plurality of the images (101)may be provided in real-time to the anomaly detection system (102). Inanother embodiment, the plurality of the images (101) may be obtainedfrom a storage medium (not shown in the figure) such as a database, aUniversal Serial Bus (USB) based hard disk, a compact disk, and the likeassociated with the anomaly detection system (102). The plurality ofimages (101), for example, may include at least one of a color image, agrayscale image, an infrared image, an X-ray image, a computedtomography image, a magnetic resonance imaging based image, a nuclearmedicine imaging based image, an ultrasound image, and the like. Theabove-mentioned categories of plurality of images (101) should not beconsidered as a limitation rather be considered as examples. The personskilled in the art appreciates the use of other categories of images inaddition to the above-mentioned examples.

In an embodiment, the anomaly (104) detected by the anomaly detectionsystem (102) may include, for example, at least one of bank fraud, astructural defect, medical disease or disorder, an intrusion detection,and the like. The person skilled in the art appreciates the use of theanomaly detection system (102) to detect the anomaly (104) in variousdomains in addition to the above-mentioned examples. In oneimplementation, the anomaly detection system (102) determines a subsetof images from the plurality of images (101). The subset of imagesincludes one or more first features. In an embodiment, the objects inwhich a defect or an anomaly is expected are identified by the anomalydetection system (102). For example, if the plurality of images (101) isassociated with objects like buildings, bridges, towers, and the like,then the subset of images may include one or more images from theplurality of images (101) having a complete visibility of the objects.The identification of the one or more images having the completevisibility of the objects such as the edges of the objects, isindicative of the one or more first features. Alternatively, the one ormore images from the plurality of images (101) having a partialvisibility of the objects is not included in the subset of images.

In an embodiment, for each image from the subset of images, the anomalydetection system (102) may identify one or more regions comprising oneor more second features. The one or more regions are where an anomaly isexpected. For example, a location of a beam in the bridge, a location ofa pillar of the tower, and the like associated with the objects in thesubset of images may indicate the one or more regions. Further, the oneor more second features may be identified based on a variation in thepixel values in the subset of images. For example, the pixel values inthe one or more regions associated with the beam, the pillar, and thelike may have lower values when compared with the pixel values otherthan the one or more regions.

In an embodiment, the anomaly detection system (102) may detect theanomaly (104) from the subset of images based on the one or moreregions. The anomaly detection system (102) detects the anomaly (104)using the one or more second features present in the one or moreregions. For example, the anomaly (104) detected from the one or moresecond features may indicate a presence or an absence of the structuraldefect and a type of the structural defect such as “the crack”, “waterseepage” and the like when the presence of the structural defect isdetected.

In an embodiment, the anomaly detection system (102) may use one or moreArtificial Intelligence (AI) based techniques to determine the subset ofimages from the plurality of images (101), identify the one or moreregions comprising the one or more second features and detect theanomaly (104) from the subset of images using the one or more secondfeatures. For example, a first model implementing one or more AItechniques may be used to determine the subset of images from theplurality of images (101), a second model implementing one or more AItechniques may be used to identify the one or more regions comprisingthe one or more second features and a third model implementing one ormore AI techniques may be used to detect the anomaly (104) from thesubset of images using the one or more second features. The AI basedtechniques may include at least one of a supervised learning basedmodel, an unsupervised learning based model, and a reinforcementlearning based model. For example, the AI based techniques may includeat least one of deep neural networks such as Convolutional NeuralNetworks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory(LSTM), autoencoders, and the like. In another example, the AI basedtechniques may include support vector machines, decision trees, NaiveBayes Classifier, Random Forest, logistic regression, k-meansclustering, Density-Based Spatial Clustering (DBSCAN), and the like.

In an embodiment, the anomaly detection system (102) may receive theuser input (103) indicating the one or more AI techniques to be used fordetermining the subset of images, identifying the one or more regions,and detecting the anomaly (104) from the subset of images. In a firstexample, the user input (103) may indicate the anomaly detection system(102) to use a CNN with AlexNet architecture as the first model todetermine the subset of images from the plurality of images (101). In asecond example, the user input (103) may indicate the anomaly detectionsystem (102) to use the k-means clustering technique as the second modelto identify the one or more regions in the subset of images. In a thirdexample, the user input (103) may indicate the anomaly detection system(102) to use the support vector machines as the third model to detectthe anomaly (104) from the subset of images.

FIG. 2 shows a detailed block diagram of the anomaly detection system(102), in accordance with some embodiments of the present disclosure.

The anomaly detection system (102) may include a Central Processing Unit(“CPU” or “processor”) (203) and a memory (202) storing instructionsexecutable by the processor (203). The processor (203) may include atleast one data processor for executing program components for executinguser or system-generated requests. The memory (202) may becommunicatively coupled to the processor (203). The anomaly detectionsystem (102) further includes an Input/Output (I/O) interface (201). TheI/O interface (201) may be coupled with the processor (203) throughwhich an input signal or/and an output signal may be communicated. Inone embodiment, the plurality of the images (101), and the user input(103) may be received through the I/O interface (201).

In some implementations, the anomaly detection system (102) may includedata (204) and modules (209). As an example, the data (204) and modules(209) may be stored in the memory (202) configured in the anomalydetection system (102). In one embodiment, the data (204) may include,for example, an image data (205), feature data (206), anomaly data(207), and other data (208). In the illustrated FIG. 2, data (204) aredescribed herein in detail.

In an embodiment, the image data (205) may include the plurality ofimages (101), the subset of images, a first set of training images, anda second set of training images. The plurality of images (101) indicatesthe images obtained as the user input (103) for detecting the presenceor the absence of the anomaly (104) and the type of the anomaly (104).Further, the subset of images indicates the one or more images from theplurality of images (101) where the presence of the anomaly (104) isexpected. Furthermore, the first set of training images and the secondset of training images indicates the images, corresponding first labeland a second label used to train the first model and the third modelrespectively. The first label indicates the presence of the one or morefirst features and the second label indicates an actual anomaly, and thetype of the actual anomaly in the first set of training images and thesecond set of training images respectively.

In an embodiment, the feature data (206) may include the one or morefirst features used by the first model for determining the subset ofimages. Further, the feature data (206) may include one or more clustersidentified by the second model. Furthermore, the feature data (206) mayinclude one or more second features used by the third model fordetecting the anomaly (104) and the type of anomaly (104).

In an embodiment, the anomaly data (207) may include the anomaly (104)and the type of anomaly (104) detected in the subset of images. Further,the anomaly data (207) may include a count of occurrences of each typeof the anomaly (104) from the subset of images and a first scoreassociated with the anomaly (104) detected. The first score may indicatea confidence value associated with the output of the third model.

In an embodiment, the other data (208) may include one or more firstparameters associated with the first model, one or more secondparameters associated with the third model, a first error associatedwith the first model, a second error associated with the third model,the output of the first model, the output of the third model, and thelike.

In some embodiments, the data (204) may be stored in the memory (202) inthe form of various data structures. Additionally, the data (204) may beorganized using data models, such as relational or hierarchical datamodels. The other data (208) may store data, including temporary dataand temporary files, generated by the modules (209) for performing thevarious functions of the anomaly detection system (102).

In some embodiments, the data (204) stored in the memory (202) may beprocessed by the modules (209) communicatively coupled to the processor(203) of the anomaly detection system (102). The modules (209) may bestored within the memory (202) as shown in FIG. 2. In one embodiment,the modules (209) may be present outside the memory (202) andimplemented as hardware. As used herein, the term modules (209) mayrefer to an Application Specific Integrated Circuit (ASIC), a FieldProgrammable Gate Array (FPGA), an electronic circuit, a processor(shared, dedicated, or group) that execute one or more software orfirmware programs, a combinational logic circuit, and/or other suitablecomponents that provide the described functionality.

In one implementation, the modules (209) may include, for example, asubset module (210), a feature identification module (211), a trainingmodule (212), an anomaly detection module (213), and other module (214).It may be appreciated that such aforementioned modules (209) may berepresented as a single module or a combination of different modules.

In an embodiment, the subset module (210) is configured for determiningthe subset of images by providing each image from the plurality ofimages (101) as an input to the first model. The first model ispre-trained to identify the one or more first features in the pluralityof images (101). Further, the subset module (210) is configured forcategorizing each image as belonging to the subset of images or notbelonging to the subset of images based on an output of the first model.

In an embodiment, the feature identification module (211) is configuredfor identifying the one or more regions by categorizing each pixel ofeach image from the subset of images into one or more clusters using thesecond model. Further, the feature identification module (211) isconfigured for identifying at least one cluster from the one or moreclusters indicate the presence of one or more second features.Furthermore, the feature identification module (211) is configured fordetermining a plurality of pixels corresponding to the at least onecluster for each image, where the plurality of pixels indicate the oneor more regions.

In an embodiment, the training module (212) is configured for trainingthe first model by providing the first set of training images as theinput to the first model, where a first label associated with each imagein the first set of training images indicates the presence of the one ormore first features. Further, the one or more first features in eachimage from the first set of training images is detected. The one or morefirst features indicates the output of the first model. Furthermore, afirst error associated with the first model is determined based on acomparison between the output of the first model and the correspondingfirst label for the first set of training images. Thereafter, the one ormore first parameters associated with the first model is modified basedon the first error. In another embodiment, the training module (212) isconfigured for training the third model by identifying the one or moreregions comprising one or more second features in each image from asecond set of training images. Further, the one or more regions of theeach image from the second set of training images is provided as theinput to the third model. The second label associated with each imagefrom the second set of training images indicates an actual anomaly, andthe type of the actual anomaly. Furthermore, the anomaly (104) and thetype of the anomaly (104) is detected based on the one or more secondfeatures in the one or more regions. The anomaly (104) detected, and thetype of the anomaly (104) indicates the output of the third model.Thereafter, the second error associated with the third model isdetermined based on a comparison between the output of the third modeland the corresponding second label associated with the second set oftraining images. Subsequently, one or more second parameters associatedwith the third model is modified based on the second error.

In an embodiment, the anomaly detection module (213) is configured fordetecting the anomaly (104) by providing the one or more regions of theeach image as the input to the third model. Where the third model ispre-trained to detect the anomaly (104), the type of the anomaly (104)and the first score associated with the anomaly (104) detected based onone or more second features. Further, the anomaly detection module (213)is configured for consolidating the output of the third model bycomputing the count of occurrences of each type of the anomaly (104) inthe subset of images and discarding the type of anomaly (104) identifiedas outliers based on the count of occurrences and the first score.Furthermore, the anomaly detection module (213) is configured foraggregating the first score associated with the each type of the anomaly(104) after discarding the outliers. Thereafter, the anomaly detectionmodule (213) is configured for determining the anomaly (104) and thetype of the anomaly (104) based on the aggregated first score.

In an embodiment, the other module (214) may be used to receive the userinput (103) and select the one or more AI based techniques correspondingto the first model, second model, and the third model for determiningthe subset of images from the plurality of images (101), identifying theone or more regions comprising the one or more second features anddetect the anomaly (104) from the subset of images using the one or moresecond features respectively.

FIG. 3 shows a flowchart illustrating method steps for detecting ananomaly (104) using a plurality of images (101), in accordance with someembodiment of the present disclosure.

The order in which the method (300) may be described is not intended tobe construed as a limitation, and any number of the described methodblocks may be combined in any order to implement the method.Additionally, individual blocks may be deleted from the methods withoutdeparting from the scope of the subject matter described herein.Furthermore, the method may be implemented in any suitable hardware,software, firmware, or combination thereof.

At the step (301), the anomaly detection system (102) determines thesubset of images from the plurality of images (101), comprising one ormore first features.

In an embodiment, the anomaly detection system (102) may receive theuser input (103) indicating the one or more AI based techniques to beused as the first model for determining the subset of images from theplurality of images (101). For example, the user input (103) mayindicate a CNN with AlexNet architecture to be used as the first model.

In one embodiment, the first model is pre-trained to identify the one ormore first features in the plurality of images (101). Further, the firstmodel is pre-trained to determine the subset of images from theplurality of images (101) where the subset of images comprises the oneor more first features. The first model is trained using the first setof training images (401), where the first label (402) associated witheach image in the first set of training images (401) indicates thepresence of the one or more first features or the absence of the one ormore first features as shown in FIG. 4A. Further, the first set oftraining images (401) is provided as the input to the first model (403)as shown in FIG. 4B. The first model (403) detects the one or more firstfeatures in each image from the first set of training images (401). Theone or more first features detected by the first model (403) isindicated as the output of the first model (403) as shown in FIG. 4B. Ina first example, a first output (404) (i.e., the output (404) of thefirst model (403) used interchangeably in the present disclosure)indicated by a “zero” may denote the absence of the one or more firstfeatures corresponding to an image from the first training set providedas the input to the first model (403). In a second example, the firstoutput (404) indicated by a “one” may denote the presence of the one ormore first features corresponding to the image from the first trainingset provided as the input to the first model (403). In anotherembodiment, the first output (404) indicated by a value in the rangefrom “zero” to “one” may denote the partial presence of the one or morefirst features.

In an embodiment, the first output (404) obtained from the first model(403) may be provided to an error computation unit (405) as shown inFIG. 4B. The error computation unit may be a part of the training module(212). The error computation unit (405) determines the first errorassociated with the first model (403) based on the comparison betweenthe output (404) of the first model (403) and the corresponding firstlabel (402) for each image in the first set of training images (401).The person skilled in the art appreciates the use of one or more errorcomputation techniques related to the one or more AI based techniquessuch as a mean-squared-error, a cross-entropy loss, a Huber loss, and ahinge loss, a Divergence Loss and the like.

In an embodiment, the one or more first parameters associated with thefirst model (403) is modified based on the first error as shown in FIG.4B. For example, the one or more parameters of the first model (403) mayinclude at least one of the weight values of the first model (403),connections between plurality of nodes in the first model (403), thelearning rate, hyperparameters associated with the first model (403) andthe like. Further, the one or more first parameters of the first model(403) may be modified using the first error corresponding to the firstset of training images (401) until the first model (403) is trained todetermine the presence and the absence of the one or more firstfeatures. In one embodiment, the training of the first model (403) maybe performed as an offline process and/or as an online process. Thetrained first model (403) is used to determine the subset of images fromthe plurality of images in real-time.

In an embodiment, the plurality of the images may be obtained by theanomaly detection system (102) for detecting the anomaly (104) via theuser input (103). The anomaly detection system (102) may provide eachimage from the plurality of images (101) as the input to the first model(403) in the anomaly detection system (102) for determining the subsetof images (406) as shown in FIG. 4C. The first model (403) ispre-trained to determine the subset of images (406) from the pluralityof images (101) is denoted as an inference stage of the first model(403). Further, the anomaly detection system (102) may categorize theimage as belonging to the subset of images (406) based on the firstoutput (404) of the first model (403) when the image includes the one ormore first features. Furthermore, the anomaly detection system (102) maycategorize the image as not belonging to the subset of images (406)based on the first output (404) of the first model (403) when the imagedoes not include the one or more first features. In a first example,when the output (404) of the first model (403) is greater than apre-defined threshold such as 0.63, the anomaly detection system (102)may categorize the image as belonging to the subset of images (406). Ina second example, when the output (404) of the first model (403) islesser than the pre-defined threshold such as 0.63, the anomalydetection system (102) may categorize the image as belonging to thesubset of images (406). The pre-defined threshold may be a number in therange zero to one.

In a first example, consider a ceramic product manufacturing industry,where the plurality of images (101) of the ceramic product is providedto the first model (403). The first model (403) may determine the subsetof images (406) using the one or more first features indicative of “anamount of ceramic product visible in the image”, “a presence of morethan one ceramic product in the image”, “blur-free images”, “brightnessor intensity values of the image” and the like. In a second example,consider the medical images such as Computerized Tomography (CT) scanimages of a subject. The first model (403) may determine the subset ofimages (406) using the one or more first features indicative the“complete presence of an organ such as a lung” and the like.

Referring back to FIG. 3, at the step (302), the anomaly detectionsystem (102) identifies the one or more regions comprising one or moresecond features in each image from the subset of images (406).

In an embodiment, the anomaly detection system (102) may receive theuser input (103) indicating the one or more AI based techniques to beused as the second model for identifying the one or more regions. Forexample, the user input (103) may indicate an unsupervised learningtechnique based k-means learning model.

In an embodiment, the second model may be pre-trained to identify thepresence of one or more second features in the subset of images (406)using the first set of training images (401) with a first label (402)indicating the presence of the one or more first features as shown inFIG. 4D. The second model may learn one or more centroids (407)corresponding to one or more clusters as shown in FIG. 4D. For example,“Cluster—1” may indicate the absence of the one or more second featuresand “Cluster—2” and “Cluster—3” may indicate the presence of the one ormore second features. Further, X-coordinate value and Y-coordinate valuemay indicate at least one of a co-ordinates of each pixel in the subsetof images (406), the intensity value associated with each pixel in thesubset of images (406) and the like.

In an embodiment, the anomaly detection system (102) may identify theone or more regions by categorizing the each pixel of the each imagefrom the subset of images (406) into one or more clusters using thesecond model. In an example, for each pixel the distance from the one ormore centroids (407) is computed and the pixel is categorized into thecluster corresponding to the centroid having minimum distance with thepixel. Further, the anomaly detection system (102) identifies at leastone cluster from the one or more clusters that indicate the presence ofone or more second features. For example, “Cluster—2 and Cluster—3” maybe identified as having the second features as shown in FIG. 4D.Further, the anomaly detection system (102) determines the plurality ofpixels corresponding to the at least one cluster for each image based onthe output of the second model (408) as shown in FIG. 4E. The pluralityof pixels indicates the one or more regions (409) in each image for thesubset of images (406) as shown in FIG. 4E. For example, the pluralityof pixels corresponding to “Cluster—2 and Cluster—3” indicate the one ormore regions (409) in each image for the subset of images (406).

In a first example, consider the ceramic product manufacturing industry,where the subset of images (406) of the ceramic product is provided tothe second model (408). The second model (408) may identify the one ormore regions (409) in the subset of images (406) indicative of thepresence of the one or more second features related to the ceramicproduct in which the anomaly (104) is expected. In a second example,consider the medical images such as computerized tomography (CT) scanimages of a subject. The second model (408) may identify the one or moreregions (409) in the subset of images (406) indicative of the presenceof the one or more second features related to an organ such as lung or apart of the body of the subject in which the anomaly (104) is expected.

Referring back to FIG. 3, at the step (303), the anomaly detectionsystem (102) detects the anomaly (104) from the subset of images (406)based on the one or more regions (409).

In an embodiment, the anomaly detection system (102) may obtain the userinput (103) indicating the one or more AI based techniques to be used asthe third model for detecting the anomaly (104) from the subset ofimages (406). For example, the user input (103) may indicate a deeplearning based CNN technique having a Google-net® architecture. Further,the anomaly detection system (102) may obtain the user input (103)indicating the type of the anomalies to be detected using the thirdmodel. In a first example, consider the ceramic product manufacturingindustry, where the user input (103) may indicate the anomaly detectionsystem (102) to detect only for the presence of the “structural defect”in the ceramic product. In a second example, the user input (103) mayindicate the anomaly detection system (102) to detect the presence ofthe “structural defect”, “a paint defect”, and the like in the ceramicproduct.

In an embodiment, the third model is pre-trained to detect the anomaly(104), the type of the anomaly (104) and determine the first scoreassociated with the anomaly (104) based on one or more second features.The third model is trained by using a second set of training images(410) and a corresponding second label (411) associated with each imagefrom the second set of training images (410) as shown in FIG. 4F. Thesecond label (411) indicates a presence or absence of the actualanomaly, and the type of the actual anomaly if the presence of theactual anomaly is indicated. Further, the anomaly detection system (102)identifies the one or more regions (409) comprising the one or moresecond features in the each image from the subset of images (406) asshown in FIG. 4F. The one or more regions (409) may be identified usingthe second model (408).

In an embodiment, the one or more regions (409) of the each image fromthe second set of training images (410) is provided as the input to thethird model (412) as shown in FIG. 4G. Further, the anomaly (104) andthe type of the anomaly (104) is detected based on the one or moresecond features in the one or more regions (409). The anomaly (104)detected, and the type of the anomaly (104) indicates the output (413)of the third model (412) denoted as third output (413) as shown in FIG.4G. The phrase “output of the third model (412)” and “third output(413)” is used interchangeably in the present disclosure. Furthermore,the third output (413) is provided as an input to the error computationunit (405) for determining a second error associated with the thirdmodel (412). The second error is determined based on a comparisonbetween the output (413) of the third model (412) and the correspondingsecond label (411) associated with the second set of training images(410). The person skilled in the art appreciates the use of one or moreerror computation techniques related to the one or more AI basedtechniques such as the mean-squared-error, the cross-entropy loss, theHuber loss, and the hinge loss, the Divergence Loss and the like.Thereafter, one or more second parameters associated with the thirdmodel (412) is modified based on the second error as shown in FIG. 4G.For example, the one or more parameters associated with the third model(412) may include at least one of the weight values of the third model(412), connections between plurality of nodes in the third model (412),the learning rate, the hyperparameters associated with the third model(412) and the like. The trained third model (412) is used for detectingthe anomaly (104) in the subset of images (406) in real-time.

In an embodiment, the anomaly detection system (102) detects the anomaly(104) by providing the one or more regions (409) of the each image fromthe subset of images (406) as the input to the third model (412) asshown in FIG. 4H. The third model (412) used to detect the anomaly (104)is denoted as an inference stage of the third model (412). The thirdoutput (413) indicates the presence or the absence of the anomaly (104),the type (414) of the anomaly (104), and the first score (415)associated with the each type (414) of the anomaly (104) in each imagefrom the subset of images (406) as shown in FIG. 4H. Further, theanomaly detection system (102) consolidates an output (413) of the thirdmodel (412) corresponding to each image for detecting the anomaly (104)in the subset of images (406).

In an embodiment, the anomaly detection system (102) consolidates theoutput (413) of the third model (412) by computing the count (416) ofoccurrences of each type (414) of the anomaly (104) in the subset ofimages (406) as shown in FIG. 4I. Further, the anomaly detection system(102) discards the type (414) of anomaly (104) identified as outliers(417) (410) based on the count (416) of occurrences and the first score(415) as shown in FIG. 4I. If the count (416) of occurrences associatedwith the type (414) of the anomaly (104) is lesser than a pre-determinedthreshold value, then the type (414) of the anomaly (104) is identifiedas the outlier (417) and discarded. If the first score (415) associatedwith each occurrence of the type (414) of the anomaly (104) is lesserthan a pre-determined value, then the type (414) of the anomaly (104) isidentified as the outlier (417) and discarded. In one embodiment, theoutliers (417) may be identified using at least one of extreme valueanalysis, probabilistic and statistical modeling, linear regressionmodels, proximity based models, and the like. For example, the “Type(414)—2”, “Type (414)—N” and “No Anomaly” are identified as the outliers(417) and discarded based on the count (416) of occurrences and thefirst score (415) as shown in FIG. 4I. Furthermore, the anomalydetection system (102) aggregates (such as determining mean or average)the first score (415) associated with the each type (414) of the anomaly(104) after discarding the outliers (417). Thereafter, the anomalydetection system (102) determines the anomaly (104) and the type (414)of the anomaly (104) based on the aggregated first score (415). Forexample, the anomaly detection system (102) detects the presence of the“Type (414)—1” anomaly (104) with a confidence value equal to theaggregated first score (415) (for example, 94%).

In a first example, consider the ceramic product manufacturing industry,where the one or more regions (409) in the subset of images (406) isprovided as the input to the third model (412). Further, the output(413) of the third model (412) is consolidated to detect the presence ofthe anomaly (104) (i.e., the presence of the manufacturing defect) andthe type (414) of anomaly (104) as “a crack in the ceramic product with87% confidence value”, “overlapped or distorted pattern painted on theceramic product with 96% confidence value” and the like. In a secondexample, consider the medical images such as computerized tomography(CT) scan images of the subject, where the one or more regions (409) inthe subset of images (406) is provided as the input to the third model(412). Further, the output (413) of the third model (412) isconsolidated to detect the presence of the anomaly (104) (i.e., thedisease or the disorder) and the type (414) of anomaly (104) as“COVID-19 with a confidence value of 92%” and the like. In a thirdexample, consider the medical images such as computerized tomography(CT) scan images of the subject, where the one or more regions (409) inthe subset of images (406) is provided as the input to the third model(412). Further, the output (413) of the third model (412) isconsolidated to detect the absence of the anomaly (104) with aconfidence value of 87%.

The method of detecting the anomaly (104) using the plurality of images(101) uses one or more Artificial Intelligence (AI) based techniques todetermine the subset of images (406), identify the one or more regions(409) and detect the anomaly (104) from the subset of images (406).Further, the first model (403) used to determine the subset of images(406) filters or removes the one or more images without the one or morefirst features and/or filters or removes the one or more images withpartial one or more first features. The filtering of the subset ofimages (406) from the plurality of images (101) increases the accuracyof the third model (412) used to detect the anomaly (104) and reducesthe computational resources and the time constraint required to detectthe anomaly (104). Further, the second model (408) indicates the one ormore regions (409) comprising the one or more second features whichreduces the computational resources and the time constraint required todetect the anomaly (104) using the third model (412) because the entireimage need not be processed to detect the anomaly (104). Furthermore,consolidating the output (413) of the third model (412) improves theaccuracy of the detected anomaly (104) due to removal of the outliers(417) which contributes to inaccurate results.

Computer System

FIG. 5 illustrates a block diagram of an exemplary computer system (500)for implementing embodiments consistent with the present disclosure. Inan embodiment, the computer system (500) may be used to implement themethod of detecting the anomaly (104) using the plurality of images(101). The computer system (500) may comprise a central processing unit(“CPU” or “processor”) (502). The processor (502) may comprise at leastone data processor for executing program components for dynamic resourceallocation at run time. The processor (502) may include specializedprocessing units such as integrated system (bus) controllers, memory(502) management control units, floating point units, graphicsprocessing units, digital signal processing units, etc.

The processor (502) may be disposed in communication with one or moreinput/output (I/O) devices (not shown) via I/O interface (501). The I/Ointerface (501) may employ communication protocols/methods such as,without limitation, audio, analog, digital, monoaural, RCA, stereo,IEEE-1394, serial bus, universal serial bus (USB), infrared, PS/2, BNC,coaxial, component, composite, digital visual interface (DVI),high-definition multimedia interface (HDMI), RF antennas, S-Video, VGA,IEEE 802.n/b/g/n/x, Bluetooth, cellular (e.g., code-division multipleaccess (CDMA), high-speed packet access (HSPA+), global system formobile communications (GSM), long-term evolution (LTE), WiMax, or thelike), etc.

Using the I/O interface (501), the computer system (500) may communicatewith one or more I/O devices. For example, the input device (510) may bean antenna, keyboard, mouse, joystick, (infrared) remote control,camera, card reader, fax machine, dongle, biometric reader, microphone,touch screen, touchpad, trackball, stylus, scanner, storage device,transceiver, video device/source, etc. The output device (511) may be aprinter, fax machine, video display (e.g., cathode ray tube (CRT),liquid crystal display (LCD), light-emitting diode (LED), plasma, Plasmadisplay panel (PDP), Organic light-emitting diode display (OLED) or thelike), audio speaker, etc.

In some embodiments, the computer system (500) is connected to theservice operator through a communication network (509). The processor(502) may be disposed in communication with the communication network(509) via a network interface (503). The network interface (503) maycommunicate with the communication network (509). The network interface(503) may employ connection protocols including, without limitation,direct connect, Ethernet (e.g., twisted pair 10/100/1000 Base T),transmission control protocol/Internet protocol (TCP/IP), token ring,IEEE 802.11a/b/g/n/x, etc. The communication network (509) may include,without limitation, a direct interconnection, e-commerce network, a peerto peer (P2P) network, local area network (LAN), wide area network(WAN), wireless network (e.g., using Wireless Application Protocol), theInternet, Wi-Fi, etc. Using the network interface (503) and thecommunication network (509), the computer system (500) may communicatewith the one or more service operators.

In some embodiments, the processor (502) may be disposed incommunication with a memory (505) (e.g., RAM, ROM, etc. not shown inFIG. 5 via a storage interface (504). The storage interface (504) mayconnect to memory (505) including, without limitation, memory drives,removable disc drives, etc., employing connection protocols such asserial advanced technology attachment (SATA), Integrated DriveElectronics (IDE), IEEE-1394, Universal Serial Bus (USB), fiber channel,Small Computer Systems Interface (SCSI), etc. The memory drives mayfurther include a drum, magnetic disc drive, magneto-optical drive,optical drive, Redundant Array of Independent Discs (RAID), solid-statememory devices, solid-state drives, etc.

The memory (505) may store a collection of program or databasecomponents, including, without limitation, user interface (506), anoperating system (507), web server (508) etc. In some embodiments,computer system (500) may store user/application data (506), such as thedata, variables, records, etc. as described in this disclosure. Suchdatabases may be implemented as fault-tolerant, relational, scalable,secure databases such as Oracle or Sybase.

The operating system (507) may facilitate resource management andoperation of the computer system (500). Examples of operating systemsinclude, without limitation, APPLE® MACINTOSH® OS X®, UNIX®, UNIX-likesystem distributions (E.G., BERKELEY SOFTWARE DISTRIBUTION® (BSD),FREEBSD®, NETBSD®, OPENBSD, etc.), LINUX® DISTRIBUTIONS (E.G., RED HAT®,UBUNTU®, KUBUNTU®, etc.), IBM®OS/2®, MICROSOFT® WINDOWS® (XP®,VISTA®/7/8, 10 etc.), APPLE® IOS®, GOOGLE™ ANDROID™, BLACKBERRY® OS, orthe like.

In some embodiments, the computer system (500) may implement a webbrowser (not shown in the Figure) stored program component. The webbrowser may be a hypertext viewing application, such as MICROSOFT®INTERNET EXPLORER®, GOOGLE™ CHROME™, MOZILLA® FIREFOX®, APPLE® SAFARI®,etc. Secure web browsing may be provided using Secure HypertextTransport Protocol (HTTPS), Secure Sockets Layer (SSL), Transport LayerSecurity (TLS), etc. Web browsers (508) may utilize facilities such asAJAX, HTML, ADOBE® FLASH®, JAVASCRIPT®, JAVA®, Application ProgrammingInterfaces (APIs), etc. In some embodiments, the computer system (500)may implement a mail server stored program component not shown in theFigure). The mail server may be an Internet mail server such asMicrosoft Exchange, or the like. The mail server may utilize facilitiessuch as Active Server Pages (ASP), ACTIVEX®, ANSI® C++/C#, MICROSOFT®,.NET, CGI SCRIPTS, JAVA®, JAVASCRIPT®, PERL®, PHP, PYTHON®, WEBOBJECTS®,etc. The mail server may utilize communication protocols such asInternet Message Access Protocol (IMAP), Messaging ApplicationProgramming Interface (MAPI), MICROSOFT® Exchange, Post Office Protocol(POP), Simple Mail Transfer Protocol (SMTP), or the like. In someembodiments, the computer system (500) may implement a mail clientstored program component not shown in the Figure). The mail client maybe a mail viewing application, such as APPLE® MAIL, MICROSOFT®ENTOURAGE®, MICROSOFT® OUTLOOK®, MOZILLA® THUNDERBIRD®, etc.

Furthermore, one or more computer-readable storage media may be utilizedin implementing embodiments consistent with the present invention. Acomputer-readable storage medium (103) refers to any type of physicalmemory on which information or data readable by a processor may bestored. Thus, a computer-readable storage medium (103) may storeinstructions for execution by one or more processors, includinginstructions for causing the processors to perform steps or stagesconsistent with the embodiments described herein. The term“computer-readable medium” should be understood to include tangibleitems and exclude carrier waves and transient signals, i.e.,non-transitory. Examples include Random Access memory (RAM), Read-Onlymemory (ROM), volatile memory, non-volatile memory, hard drives, CompactDisc (CD) ROMs, Digital Video Disc (DVDs), flash drives, disks, and anyother known physical storage media.

In an embodiment, the computer system (500) may comprise remote devices(512). The remote devices (512) may indicate a device for obtaining theuser input (103), the pre-trained first model, pre-trained third model,the plurality of the images and the like through the communicationnetwork (509).

In light of the above-mentioned advantages and the technicaladvancements provided by the disclosed method and system, the claimedsteps as discussed above are not routine, conventional, or wellunderstood in the art, as the claimed steps enable the followingsolutions to the existing problems in conventional technologies.Further, the claimed steps clearly bring an improvement in thefunctioning of the device itself as the claimed steps provide atechnical solution to a technical problem.

The terms “an embodiment”, “embodiment”, “embodiments”, “theembodiment”, “the embodiments”, “one or more embodiments”, “someembodiments”, and “one embodiment” mean “one or more (but not all)embodiments of the invention(s)” unless expressly specified otherwise.

The terms “including”, “comprising”, “having” and variations thereofmean “including but not limited to”, unless expressly specifiedotherwise.

The enumerated listing of items does not imply that any or all of theitems are mutually exclusive, unless expressly specified otherwise. Theterms “a”, “an” and “the” mean “one or more”, unless expressly specifiedotherwise.

A description of an embodiment with several components in communicationwith each other does not imply that all such components are required. Onthe contrary, a variety of optional components are described toillustrate the wide variety of possible embodiments of the invention.

When a single device or article is described herein, it may be readilyapparent that more than one device/article (whether or not theycooperate) may be used in place of a single device/article. Similarly,where more than one device or article is described herein (whether ornot they cooperate), it may be readily apparent that a singledevice/article may be used in place of the more than one device orarticle or a different number of devices/articles may be used instead ofthe shown number of devices or programs. The functionality and/or thefeatures of a device may be alternatively embodied by one or more otherdevices which are not explicitly described as having suchfunctionality/features. Thus, other embodiments of the invention neednot include the device itself.

The illustrated operations of FIG. 3 show certain events occurring in acertain order. In alternative embodiments, certain operations may beperformed in a different order, modified or removed. Moreover, steps maybe added to the above described logic and still conform to the describedembodiments. Further, operations described herein may occur sequentiallyor certain operations may be processed in parallel. Yet further,operations may be performed by a single processing unit or bydistributed processing units.

Finally, the language used in the specification has been principallyselected for readability and instructional purposes, and it may not havebeen selected to delineate or circumscribe the inventive subject matter.It is therefore intended that the scope of the invention be limited notby this detailed description, but rather by any claims that issue on anapplication based here on. Accordingly, the disclosure of theembodiments of the invention is intended to be illustrative, but notlimiting, of the scope of the invention, which is set forth in thefollowing claims.

While various aspects and embodiments have been disclosed herein, otheraspects and embodiments may be apparent to those skilled in the art. Thevarious aspects and embodiments disclosed herein are for purposes ofillustration and are not intended to be limiting, with the true scopebeing indicated by the following claims.

REFERRAL NUMERALS

Reference number Description 101 Plurality of images 102 Anomalydetection system 103 User input 104 anomaly 201 I/O interface 202 Memory203 Processor 204 Data 205 Image data 206 Feature data 207 Anomaly data208 Other data 209 Modules 210 Subset module 211 Feature identificationmodule 212 Training module 213 Anomaly detection module 214 Other module401 First set of training images 402 First label 403 First model 404First output 405 Error computation unit 406 Subset of images 407 One ormore centroids 408 Second model 409 One or more regions 410 Second setof training images 411 Second label 412 Third model 413 Third output 414Type 415 First score 416 Count 417 Outliers 500 Computer System 501 I/Ointerface 502 Processor 503 Network Interface 504 Storage Interface 505Memory 506 User Interface 507 Operating System 508 Web Server 509Communication Network 510 Input Device 511 Output Device 512 RemoteDevices

We claim:
 1. A method for detecting an anomaly using a plurality ofimages, the method comprising: determining, by an anomaly detectionsystem, a subset of images from the plurality of images, comprising oneor more first features; identifying, by the anomaly detection system,one or more regions comprising one or more second features in each imagefrom the subset of images; and detecting, by the anomaly detectionsystem, the anomaly from the subset of images based on the one or moreregions.
 2. The method of claim 1, wherein determining the subset ofimages, identifying the one or more regions and detecting the anomalyfrom the subset of images are performed using one or more ArtificialIntelligence (AI) based techniques.
 3. The method of claim 1, whereindetermining the subset of images comprises: providing each image fromthe plurality of images as an input to a first model in the anomalydetection system, wherein the first model is pre-trained to identify theone or more first features in the plurality of images; and categorizing,based on an output of the first model, each image as belonging to thesubset of images; or not belonging to the subset of images.
 4. Themethod of claim 3, wherein training the first model comprises: providinga first set of training images as the input to the first model, whereina first label associated with each image in the first set of trainingimages indicates the presence of the one or more first features;detecting the one or more first features in each image from the firstset of training images, wherein detecting the one or more first featuresindicates the output of the first model; determining a first errorassociated with the first model based on a comparison between the outputof the first model and the corresponding first label for the first setof training images; and modifying one or more first parametersassociated with the first model based on the first error.
 5. The methodof claim 1, wherein identifying the one or more regions comprises:categorizing each pixel of each image from the subset of images into oneor more clusters using a second model in the anomaly detection system;identifying at least one cluster from the one or more clusters indicatethe presence of one or more second features; and determining a pluralityof pixels corresponding to the at least one cluster for each image,wherein the plurality of pixels indicate the one or more regions.
 6. Themethod of claim 1, wherein detecting the anomaly comprises: providingthe one or more regions of the each image as an input to a third model,wherein the third model is pre-trained to detect the anomaly, a type ofthe anomaly and a first score associated with the anomaly detected basedon one or more second features; and consolidating an output of the thirdmodel corresponding to each image for detecting the anomaly in thesubset of images.
 7. The method of claim 6, wherein training the thirdmodel comprises: identifying the one or more regions comprising one ormore second features in each image from a second set of training images;providing the one or more regions of the each image from the second setof training images as the input to the third model, wherein a secondlabel associated with each image from the second set of training imagesindicates an actual anomaly, and the type of the actual anomaly;detecting the anomaly and the type of the anomaly based on the one ormore second features in the one or more regions, wherein the anomalydetected, and the type of the anomaly indicates the output of the thirdmodel; determining a second error associated with the third model basedon a comparison between the output of the third model and thecorresponding second label associated with the second set of trainingimages; and modifying one or more second parameters associated with thethird model based on the second error.
 8. The method of claim 6, whereinconsolidating the output of the third model comprises: computing a countof occurrences of each type of the anomaly in the subset of images;discarding the type of anomaly identified as outliers based on the countof occurrences and the first score; aggregating the first scoreassociated with the each type of the anomaly after discarding theoutliers; and determining the anomaly and the type of the anomaly basedon the aggregated first score.
 9. An anomaly detection system fordetecting an anomaly using a plurality of images, wherein the anomalydetection system comprises: a processor; and a memory communicativelycoupled to the processor, wherein the memory stores the processorinstructions, which, on execution, causes the processor to: determine asubset of images from the plurality of images, comprising one or morefirst features; identify one or more regions comprising one or moresecond features in each image from the subset of images; and detect theanomaly from the subset of images based on the one or more regions. 10.The anomaly detection system of claim 9, wherein the processor isconfigured to determine the subset of images, identify the one or moreregions and detect the anomaly from the subset of images are performedusing one or more Artificial Intelligence (AI) based techniques.
 11. Theanomaly detection system of claim 9, wherein the processor is configuredto determine the subset of images comprises: providing each image fromthe plurality of images as an input to a first model in the anomalydetection system, wherein the first model is pre-trained to identify theone or more first features in the plurality of images; and categorizing,based on an output of the first model, each image as belonging to thesubset of images; or not belonging to the subset of images.
 12. Theanomaly detection system of claim 9, wherein the processor is configuredto train the first model comprises: providing a first set of trainingimages as the input to the first model, wherein a first label associatedwith each image in the first set of training images indicates thepresence of the one or more first features; detecting the one or morefirst features in each image from the first set of training images,wherein detecting the one or more first features indicates the output ofthe first model; determining a first error associated with the firstmodel based on a comparison between the output of the first model andthe corresponding first label for the first set of training images; andmodifying one or more first parameters associated with the first modelbased on the first error.
 13. The anomaly detection system of claim 9,wherein the processor is configured to identify the one or more regionscomprises: categorizing each pixel of each image from the subset ofimages into one or more clusters using a second model in the anomalydetection system; identifying at least one cluster from the one or moreclusters indicate the presence of one or more second features; anddetermining a plurality of pixels corresponding to the at least onecluster for each image, wherein the plurality of pixels indicate the oneor more regions.
 14. The anomaly detection system of claim 9, whereinthe processor is configured to detect the anomaly comprises: providingthe one or more regions of the each image as an input to a third model,wherein the third model is pre-trained to detect the anomaly, a type ofthe anomaly and a first score associated with the anomaly detected basedon one or more second features; and consolidating an output of the thirdmodel corresponding to each image for detecting the anomaly in thesubset of images.
 15. The anomaly detection system of claim 9, whereinthe processor is configured to train the third model comprises:identifying the one or more regions comprising one or more secondfeatures in each image from a second set of training images; providingthe one or more regions of the each image from the second set oftraining images as the input to the third model, wherein a second labelassociated with each image from the second set of training imagesindicates an actual anomaly, and the type of the actual anomaly;detecting the anomaly and the type of the anomaly based on the one ormore second features in the one or more regions, wherein the anomalydetected, and the type of the anomaly indicates the output of the thirdmodel; determining a second error associated with the third model basedon a comparison between the output of the third model and thecorresponding second label associated with the second set of trainingimages; and modifying one or more second parameters associated with thethird model based on the second error.
 16. The anomaly detection systemof claim 9, wherein the processor is configured to consolidating theoutput of the third model comprises: computing a count of occurrences ofeach type of the anomaly in the subset of images; discarding the type ofanomaly identified as outliers based on the count of occurrences and thefirst score; aggregating the first score associated with the each typeof the anomaly after discarding the outliers; and determining theanomaly and the type of the anomaly based on the aggregated first score.17. A non-transitory computer readable medium including instructionsstored thereon that when processed by at least one processor cause adevice to perform operations comprising: determining, by an anomalydetection system, a subset of images from the plurality of images,comprising one or more first features; identifying, by the anomalydetection system, one or more regions comprising one or more secondfeatures in each image from the subset of images; and detecting, by theanomaly detection system, the anomaly from the subset of images based onthe one or more regions.
 18. The media of claim 17, wherein theinstructions causes the processor to determine the subset of imagescomprises: providing each image from the plurality of images as an inputto a first model in the anomaly detection system, wherein the firstmodel is pre-trained to identify the one or more first features in theplurality of images; and categorizing, based on an output of the firstmodel, each image as belonging to the subset of images; or not belongingto the subset of images.
 19. The media of claim 17, wherein theinstructions causes the processor to identify the one or more regionscomprises: categorizing each pixel of each image from the subset ofimages into one or more clusters using a second model in the anomalydetection system; identifying at least one cluster from the one or moreclusters indicate the presence of one or more second features; anddetermining a plurality of pixels corresponding to the at least onecluster for each image, wherein the plurality of pixels indicate the oneor more regions.
 20. The media of claim 17, wherein the instructionscauses the processor to detect the anomaly comprises: providing the oneor more regions of the each image as an input to a third model, whereinthe third model is pre-trained to detect the anomaly, a type of theanomaly and a first score associated with the anomaly detected based onone or more second features; and consolidating an output of the thirdmodel corresponding to each image for detecting the anomaly in thesubset of images.